Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
Received-SPF: neutral (nike.apache.org: 147.91.1.120 is neither permitted nor
 denied by domain of ognjen.d.blagojevic@gmail.com)
Message-ID: <50FFF72B.8000606@gmail.com>
Date: Wed, 23 Jan 2013 15:43:55 +0100
From: Ognjen Blagojevic <ognjen.d.blagojevic@gmail.com>
User-Agent: Mozilla/5.0 (Windows NT 5.1;
 rv:17.0) Gecko/20130107 Thunderbird/17.0.2
MIME-Version: 1.0
To: Tomcat Developers List <dev@tomcat.apache.org>
Subject: Re: Disable TLS compression in JSSE
References: <50F5E3A0.2090004@christopherschultz.net>
 <CALkcCptgpdcHt9c5KV5MEtYDb4_D9RDZdcYRpf1BhbK_Z=usTQ@mail.gmail.com>
In-Reply-To: 
 <CALkcCptgpdcHt9c5KV5MEtYDb4_D9RDZdcYRpf1BhbK_Z=usTQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 23.1.2013 2:13, Tim Whittington wrote:
> As far as I know, JSSE doesn't support compression.
> [1] claims this, but doesn't have a reference, and I can't find
> anything else useful on the internet, although i recall an analysis of
> the CRIME attack that claimed the same thing.

I tested couple of my Tomcat installations, each of them uses JSSE, with 
this tool:

   https://www.ssllabs.com/ssltest/analyze.html

I came to the same conclusion, JSSE probably doesn't support compression 
at all (or, at least, out-of-the-box).

-Ognjen


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org